feat: isolate privacy scanning and release signing

scripts/release/trust-policy.schema.json

@@ -0,0 +1,71 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://portfolio.invalid/schemas/trust-policy-v1.json",
+  "title": "Portfolio release trust policy",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "policyVersion", "publicationFrozen", "roots"],
+  "properties": {
+    "schema": { "const": "portfolio-trust-policy/v1" },
+    "policyVersion": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9._/-]{0,127}$"
+    },
+    "publicationFrozen": { "type": "boolean" },
+    "roots": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "approval",
+        "projection",
+        "privacyWorkload",
+        "policy",
+        "toolImage",
+        "release",
+        "publisher"
+      ],
+      "properties": {
+        "approval": { "$ref": "#/$defs/root" },
+        "projection": { "$ref": "#/$defs/root" },
+        "privacyWorkload": { "$ref": "#/$defs/root" },
+        "policy": { "$ref": "#/$defs/root" },
+        "toolImage": { "$ref": "#/$defs/root" },
+        "release": { "$ref": "#/$defs/root" },
+        "publisher": { "$ref": "#/$defs/root" }
+      }
+    }
+  },
+  "$defs": {
+    "root": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "keyId",
+        "issuerEpoch",
+        "scope",
+        "publicKeyPem",
+        "revokedEpochs",
+        "compromiseResponse"
+      ],
+      "properties": {
+        "keyId": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9][A-Za-z0-9._/-]{0,127}$"
+        },
+        "issuerEpoch": { "type": "integer", "minimum": 1 },
+        "scope": { "type": "string" },
+        "publicKeyPem": { "type": "string" },
+        "revokedEpochs": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "type": "integer", "minimum": 1 }
+        },
+        "compromiseResponse": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "type": "string" }
+        }
+      }
+    }
+  }
+}